diff options
| author |   itojun <itojun@openbsd.org> | 2001-06-22 12:30:34 +0000 |
|---|---|---|
| committer | itojun <itojun@openbsd.org> | 2001-06-22 12:30:34 +0000 |
| commit | 6b28ab666d477fa712d9c8c3e50b092a7a88acf1 (patch) | |
| tree | 00d5ff453084ab5074aed4b4a0c026a8a5c593f4 | |
| parent | o) remove unnecessary .Pp; (diff) | |
| download | wireguard-openbsd-6b28ab666d477fa712d9c8c3e50b092a7a88acf1.tar.xz wireguard-openbsd-6b28ab666d477fa712d9c8c3e50b092a7a88acf1.zip | |
do not forward packet back into point-to-point link, if the packet has
destination address that matches the p2p interface. this would
lead us to pingpong (= chews bandwidth, can be attacked from remote).
| -rw-r--r-- | sys/netinet6/ip6_forward.c | 23 |
1 files changed, 20 insertions, 3 deletions
diff --git a/sys/netinet6/ip6_forward.c b/sys/netinet6/ip6_forward.c index 1275c416e96..cec57d936f6 100644 --- a/sys/netinet6/ip6_forward.c +++ b/sys/netinet6/ip6_forward.c @@ -1,5 +1,5 @@ -/* $OpenBSD: ip6_forward.c,v 1.14 2001/06/09 06:43:38 angelos Exp $ */ -/* $KAME: ip6_forward.c,v 1.67 2001/03/29 05:34:31 itojun Exp $ */ +/* $OpenBSD: ip6_forward.c,v 1.15 2001/06/22 12:30:34 itojun Exp $ */ +/* $KAME: ip6_forward.c,v 1.74 2001/06/12 23:54:55 itojun Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -412,8 +412,25 @@ ip6_forward(m, srcrt) * modified by a redirect. */ if (rt->rt_ifp == m->m_pkthdr.rcvif && !srcrt && - (rt->rt_flags & (RTF_DYNAMIC|RTF_MODIFIED)) == 0) + (rt->rt_flags & (RTF_DYNAMIC|RTF_MODIFIED)) == 0) { + if ((rt->rt_ifp->if_flags & IFF_POINTOPOINT) != 0) { + /* + * If the incoming interface is equal to the outgoing + * one, and the link attached to the interface is + * point-to-point, then it will be highly probable + * that a routing loop occurs. Thus, we immediately + * drop the packet and send an ICMPv6 error message. + * + * type/code is based on suggestion by Rich Draves. + * not sure if it is the best pick. + */ + icmp6_error(mcopy, ICMP6_DST_UNREACH, + ICMP6_DST_UNREACH_ADDR, 0); + m_freem(m); + return; + } type = ND_REDIRECT; + } /* * Fake scoped addresses. Note that even link-local source or |